1keepalived_unconfinSeEdL_isncurxipPto_lsieclyinkuexe(p8a)likveeedp_aulnicvoendf_iunnecdo_nsfcirniepdt_script_selinux(8)
2
3
4

NAME

6       keepalived_unconfined_script_selinux  -  Security Enhanced Linux Policy
7       for the keepalived_unconfined_script processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the  keepalived_unconfined_script  pro‐
11       cesses via flexible mandatory access control.
12
13       The    keepalived_unconfined_script    processes   execute   with   the
14       keepalived_unconfined_script_t SELinux type. You can check if you  have
15       these  processes running by executing the ps command with the -Z quali‐
16       fier.
17
18       For example:
19
20       ps -eZ | grep keepalived_unconfined_script_t
21
22
23

ENTRYPOINTS

25       The keepalived_unconfined_script_t SELinux type can be entered via  the
26       keepalived_unconfined_script_exec_t file type.
27
28       The default entrypoint paths for the keepalived_unconfined_script_t do‐
29       main are the following:
30
31       /usr/libexec/keepalived(/.*)?
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       keepalived_unconfined_script policy is very flexible allowing users  to
41       setup  their  keepalived_unconfined_script  processes  in  as  secure a
42       method as possible.
43
44       The  following  process  types  are   defined   for   keepalived_uncon‐
45       fined_script:
46
47       keepalived_unconfined_script_t
48
49       Note: semanage permissive -a keepalived_unconfined_script_t can be used
50       to make the  process  type  keepalived_unconfined_script_t  permissive.
51       SELinux  does  not deny access to permissive process types, but the AVC
52       (SELinux denials) messages are still generated.
53
54

BOOLEANS

56       SELinux  policy  is  customizable  based  on  least  access   required.
57       keepalived_unconfined_script  policy is extremely flexible and has sev‐
58       eral  booleans  that  allow  you  to  manipulate  the  policy  and  run
59       keepalived_unconfined_script with the tightest access possible.
60
61
62
63       If you want to deny user domains applications to map a memory region as
64       both executable and writable, this  is  dangerous  and  the  executable
65       should be reported in bugzilla, you must turn on the deny_execmem bool‐
66       ean. Enabled by default.
67
68       setsebool -P deny_execmem 1
69
70
71
72       If you want to control the ability to mmap a low area  of  the  address
73       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
74       the mmap_low_allowed boolean. Disabled by default.
75
76       setsebool -P mmap_low_allowed 1
77
78
79
80       If you want to disable kernel module loading, you must turn on the  se‐
81       cure_mode_insmod boolean. Enabled by default.
82
83       setsebool -P secure_mode_insmod 1
84
85
86
87       If  you  want to allow unconfined executables to make their heap memory
88       executable.  Doing this is a really  bad  idea.  Probably  indicates  a
89       badly  coded  executable, but could indicate an attack. This executable
90       should be reported in bugzilla, you must turn  on  the  selinuxuser_ex‐
91       echeap boolean. Disabled by default.
92
93       setsebool -P selinuxuser_execheap 1
94
95
96
97       If  you  want  to allow unconfined executables to make their stack exe‐
98       cutable.  This should never, ever be necessary.  Probably  indicates  a
99       badly  coded  executable, but could indicate an attack. This executable
100       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
101       stack boolean. Enabled by default.
102
103       setsebool -P selinuxuser_execstack 1
104
105
106

MANAGED FILES

108       The  SELinux  process  type  keepalived_unconfined_script_t  can manage
109       files labeled with the following file types.  The paths listed are  the
110       default  paths for these file types.  Note the processes UID still need
111       to have DAC permissions.
112
113       file_type
114
115            all files on the system
116
117

FILE CONTEXTS

119       SELinux requires files to have an extended attribute to define the file
120       type.
121
122       You can see the context of a file using the -Z option to ls
123
124       Policy  governs  the  access  confined  processes  have to these files.
125       SELinux keepalived_unconfined_script policy is very  flexible  allowing
126       users  to  setup their keepalived_unconfined_script processes in as se‐
127       cure a method as possible.
128
129       The following file types are defined for keepalived_unconfined_script:
130
131
132
133       keepalived_unconfined_script_exec_t
134
135       - Set files with the keepalived_unconfined_script_exec_t type,  if  you
136       want  to transition an executable to the keepalived_unconfined_script_t
137       domain.
138
139
140
141       Note: File context can be temporarily modified with the chcon  command.
142       If  you want to permanently change the file context you need to use the
143       semanage fcontext command.  This will modify the SELinux labeling data‐
144       base.  You will need to use restorecon to apply the labels.
145
146

COMMANDS

148       semanage  fcontext  can also be used to manipulate default file context
149       mappings.
150
151       semanage permissive can also be used to manipulate  whether  or  not  a
152       process type is permissive.
153
154       semanage  module can also be used to enable/disable/install/remove pol‐
155       icy modules.
156
157       semanage boolean can also be used to manipulate the booleans
158
159
160       system-config-selinux is a GUI tool available to customize SELinux pol‐
161       icy settings.
162
163

AUTHOR

165       This manual page was auto-generated using sepolicy manpage .
166
167

SEE ALSO

169       selinux(8),   keepalived_unconfined_script(8),   semanage(8),  restore‐
170       con(8), chcon(1), sepolicy(8), setsebool(8)
171
172
173
174keepalived_unconfined_script       22-05k-e2e7palived_unconfined_script_selinux(8)
Impressum